Is Channel Fragmentation/Bonding in IEEE Networks Secure?

Transcription

1 Is Channel Fragmentation/Bonding in IEEE Networks Secure? S. Anand, K. Hong Department of ECE Stevens Institute of Technology NJ S. Sengupta Department of Mathematics & Computer Science John Jay College, City University of New York NY R. Chandramouli Department of ECE Stevens Institute of Technology NJ Abstract We address a unique security threat that arises due to channel fragmentation (or aggregation or bonding) in dynamic spectrum access (DSA) based IEEE networks. Typically, channel fragmentation, aggregation and bonding have been studied in the literature as a means to enhance the spectrum utilization. However, the loss of orthogonality between the spectrum bands due to channel fragmentation, aggregation or bonding can be exploited by malicious attackers to cause a cognitive service disruption. We present an analysis of such a threat. We determine the optimal transmit powers a malicious attacker transmits on each fragment, so as to create imum service disruption. Numerical results indicate that a malicious attacker can cause up to about 16% loss in the capacity of the system as a consequence of fragmentation. Detailed analysis is presented for channel fragmentation and can be easily applied to channel aggregation and bonding. To the best of our knowledge, this is the first analysis of such cognitive service disruption threats due to fragmentation. Index Terms DSA Networks, IEEE , Channel Fragmentation, Aggregation, Bonding, Cognitive Service Disruption. I. INTRODUCTION Dynamic spectrum access (DSA) [1] based cognitive radio networks [2] were developed as a solution to the under utilization of spectrum due to fixed spectrum allocation. Unlicensed secondary users use the spectrum (called white spaces) unused by the licensed primary users. The IEEE wireless regional area networks (WRAN) [3] emerged as the first standards for cognitive radios. The physical layer (PHY) and medium access control (MAC) specifications for secondary to use the white spaces in the television (TV) transmission band can be found in [4]. The IEEE standard specify policies for channel fragmentation, bonding and aggregation (definitions of these terms are provided in the following paragraph). We identify a potential security vulnerability resulting due to these three features. We illustrate the practicality of the attack by test-bed experiments followed by a detailed theoretical analysis. Channel fragmentation, aggregation and bonding were studied as a means to enhance the spectrum utilization in DSA networks [5]-[9] and the references therein as well as n wireless LANs [10]. Channel fragmentation refers to allocating a portion of a spectrum band, e.g., if a channel has a bandwidth of 6 MHz, fragmentation allows allocation of a portion of the spectrum band corresponding to a bandwidth of 2 MHz to a user. It is also possible to combine two contiguous spectrum bands of 2 MHz each to provide a user a channel with 4 MHz bandwidth. This is called channel bonding. Alternatively, non-contiguous spectrum bands can be aggregated and allocated to users. The IEEE standard also specifies the policies for channel fragmentation, aggregation and bonding. Sengupta et al [5] proposed a utility based graph coloring algorithm that presented the advantages using channel fragmentation and aggregation. In [6], Song and Lin present and enhanced MAC protocol for DSA networks, where the effectiveness of channel fragmentation, aggregation and bonding were demonstrated by achieving enhanced throughput. Bahl et al provided an experimental set up for channel assignment that utilizes the white spaces in the spectrum. An architecture for the utilization of DTV white spaces incorporating channel fragmentation was provided in [8]. A detailed study of channel fragmentation and related works can be found in [9]. Although channel fragmentation, aggregation and bonding Fig. 1. Test-bed experiment demonstrating leakage on other channels due to bonding. resulted in larger throughput, we identify an important security vulnerability resulting due to these features. Typically the IEEE and n networks use orthogonal channels for transmission. However, fragmentation, aggregation or

2 bonding of channels can result in loss of orthogonality and hence, mutual interference or leakage from one channel to the other. To illustrate this, we conduct test bed experiments by implementing a cognitive radio prototype [11] based on a software abstraction layer over off-the-shelf IEEE a/b/g supported by Atheros hardware chip sets. We bond two channels (corresponding to 5.24 GHz and 5.26 GHz) and measure the power on all the other channels. Fig. 1 provides the wispy image of our experimental results. The green color in the bottom-most picture in the wispy image in Fig. 1 represents the average power on the channels and the blue color represents the peak powers measured on the channels. It is observed that a power of -40 dbm on the bonded channel results in a significant leakage on the neighboring spectrum bands. This is a consequence of the loss of orthogonality between spectrum bands resulting due to bonding. Similar consequences can also be expected for channel fragmentation and aggregation. The leakage demonstrated in Fig. 1 can result in a unique denial of service (DoS) threat in IEEE based DSA networks. A malicious attacker can exploit the correlation between the non-orthogonal fragments (resulting due to fragmentation or aggregation or bonding) and cause service disruption. Service disruption in wireless networks have traditionally been viewed as jamming attacks [12]. Cognitive radios are also susceptible to multi-channel jamming [13] where the jammer can switch channels to jam multiple channels or the attacker chooses a particular set of channels and jam them [14]. However, the service disruption threat due to fragmentation is significantly different because a malicious attacker can now transmit on channel j to cause service disruption on channel i. The attack exploits the loss of orthogonality between channels which is a consequence of fragmentation, aggregation and bonding. The service disruption need not be a complete DoS, but can be a loss in the channel capacity or loss in throughput, thus resulting in degraded quality-of-service (QoS). In this paper, we present an analysis of the service disruption caused by a malicious attacker in an IEEE based DSA network with fragmentation. We study the loss in capacity due to the attacks. We formulate an optimization problem in which the malicious attacker launches attacks on the channels so as to imize the leakage in the system. We use the correlation between the channels (obtained using standard inner product definition of correlation [15]). Numerical results indicate that at low transmit powers, malicious attackers do not cause significant loss in the capacity due to fragmentation. However, for larger transmit power of malicious attackers, fragmentation can result in service disruption causing upto about 16% loss in the channel capacity. In terms of data rates, this could be between 200 Kbps to 9 Mbps. To the best of our knowledge, this is the first analysis on service disruption due to fragmentation. While the analysis presented in this paper is applicable to any DSA network in general, it is particularly applicable to IEEE WRAN where the policies for fragmentation, aggregation and bonding has been specified. Detailed analysis is presented for fragmentation and can also be easily applied to channel aggregation and bonding. The rest of the paper is organized as follows. The description of the system and the analysis of the service disruption attack is provided in Section II. Numerical results are provided in Section III and conclusions are drawn in Section IV. II. COGNITIVE SERVICE DISRUPTION Consider a DSA network (e.g, an IEEE WRAN) with N orthogonal channels which can be used by secondary users when the primary users are inactive. Each of these N channels can be fragmented into K sub-channels. Henceforth, throughout the paper, channel refers to one of the N K fragments in the system, unless explicitly mentioned otherwise. The N K fragments need not be mutually orthogonal, in general. Therefore, when signals are transmitted in the i th fragment (1 i NK), it causes energy leakage in the j th fragment (j i). This kind of energy leakage can be exploited by malicious nodes in the network to disrupt the communication of the other good secondary users in the system. It is of interest to determine the service disruption caused by a malicious attacker to the good secondary users in the system. In order to perform the analysis, we consider the following system. There are NK fragments such that the correlation between fragments i and j is ρ ij. If the corresponding fragments are orthogonal, then ρ ij 0. On channel i, the attacker transmits a signal with signal strength, E i, that corresponds to a power, P i E i 2. The total power that can be transmitted by the attacker on all the channels is P tot. Let C [c ij ] 1 i NK, where c ij ρ ij, i j and c ii 0, 1 j NK i, represent the co-variance between channels i, j, i j. Let Let e [E i ] 1 i NK represent the vector of field strengths on all the channels and let p [P i ] 1 i NK be the vector of corresponding powers. Signals transmitted on any channel cause a leakage on the other channels since the fragmented channels are not orthogonal in general. The leakage caused by the attacker on the i th channel, l i, can be written as l i NK C ije j, i, (1) which, can be written as the matrix equation, l Ce, (2) where l [l i ] 1 i NK. If the channels are all mutually orthogonal, then c ij 0, i j. Since c ii 0, i, the leakage, l i 0, i. Since fragmentation results in nonorthogonal channels, l i 0, in general. The power leaked on the i th channel can be obtained as li 2. The average power leaked on all the channels in the system, P leaked, can be written as P leaked 1 NK li 2 NK 1 NK lh l 1 NK eh C H Ce, (3) where (.) H represents the Hermitian of a vector or a matrix. 2

3 Ideally, the malicious attacker allocates its total transmit power, P tot, on all the channels, such that the impact on each of the channels is highest. In order determine the impacts on all the channels, the attacker should have an exact knowledge of all the applications on all the channels in the system, which may not be possible in general. A more practical scenario is when the attacker tried to imize the average power due to leakage, P leaked, which can be formulated as the following optimization problem e e H C H Ce e H Ae, (4) e (where A C H C), subject to the constraint, NK P i e H e P tot. (5) The matrix, A, is a Hermitian matrix (i.e., A H A and hence, has real eigen values [16]. Let P be the matrix whose columns are the eigen-vectors of A. Since A is a Hermitian matrix, P can be chosen to be unitary [16] (i.e., P H P PP H the identity matrix, I. The vector, e can be written as [16] e Pd, (6) where d [d i ] 1 i NK is another vector of length, NK. Let the set of eigen-values of A (called the spectrum of A [16]), σ(a), be σ(a) {λ 1, λ 2,, λ NK } and without loss of generality, let λ 1 λ 2 λ NK. Such an ordering is possible since λ i s are real. It is then possible to formulate the optimization problem in (4) subject to (5), in terms of d. The following lemma from matrix theory is used in describing the optimization problem and constraint with respect to d. Lemma 2.1: [16] If P is unitary in (6), then e H e d H d. From Lemma 2.1, (5) can be written as d H d NK d 2 i P tot. (7) The optimization problem in (4) can then be re-written in terms of d as d dh P H APd d dh Dd, (8) where D is the diagonal matrix, diag(λ 1, λ 2, λ n ). Therefore, the optimization problem described in (8) subject to (7), is the optimization problem, subject to NK d NK U(d) d NK λ i d 2 i (9) d 2 i P tot. (10) The following lemmas and theorem will be used to solve the optimization problem in (9) subject to (10), which, in turn, will be used to solve (4) subject to (5). Lemma 2.2: If λ k < 0, d k 0 at the optimum point. Proof: Let d ] [ di be a feasible solution such 1 i NK that dk > 0. Consider another solution ˆd [ ] ˆdi 1 i NK, where ˆd k 0 and ˆd j d j, j k. Since d is a feasible point, d i 2 i P tot, i.e., ˆd i 2 i P tot. Therefore, ˆd is also a feasible point. The proof is complete if it can be shown that U( d) < U(ˆd). U( d) NK NK NK λ d i 2 i λ i d2 i + λ k d2 k λ i ˆd2 i + λ k d2 k λ i ˆd2 i since λ k < 0 < NK U(ˆd). Lemma 2.2 implies that positive d i s should be allocated only corresponding to positive eigen values. The following lemma provides a constraint on the positive d i s. Lemma 2.3: Let λ 1 λ 2 λ m > 0 and let λ i < 0, i > m, m NK. At the optimum point, m d2 i P tot, i.e., (10) is met with equality. Proof: From Lemma 2.2, d i 0, i > m. Consider a feasible point d [ ] di such that m d 2 i P < P tot. Let] P tot P. It is noted that > 0. Consider ˆd [ˆdi, such that ˆdm d m + and ˆd i d i, i 1, 2,,m 1, m + 1, NK. Therefore, NK ˆd 2 i m ˆd 2 i m 1 d 2 i + ˆd 2 m m 1 d 2 i + d 2 m + Delta P + Ptot, i.e., ˆd is also a feasible point with m ˆd i P tot. m U(ˆd) λ ˆd i 2 i m 1 λ d i 2 i + λ ˆd i 2 m m 1 λ i d 2 i + λ i d 2 m + Delta U( d) + > U( d) since > 0. From Lemmas 2.2 and 2.3, the following theorem which yields the optimum point, d, can be obtained. Theorem 2.1: Let λ 1 λ 2 λ m > 0, m NK and λ i < 0, i > m. The objective function in (9) subject to (10) is imized for d d [d i ] 1 i NK such that d 1 P tot and d i 0, i 2, 3,,NK. [ ] Proof: From Lemma 2.2, d i 0, i > m. Let d di such that d i > 0, 1 i m and m d i P tot, according to Lemma 2.3. Therefore, m m U( d) λ i d2 i λ 1 d2 i λ 1 P tot λ 1 (d 1) 2 U(d ). 3

4 Since d H d e H e, the malicious attacker transmits on all the channels such that (5) is met with equality. The optimal vector, e that solves (4) subject to (5) can be obtained from (6) with d replaced by d. The following theorem characterizes e. Theorem 2.2: Let λ 1 λ 2 λ m > 0, m NK. Let the eigen-vector of A corresponding to λ 1 be x 1 [x i1 ] 1 i NK. Then e P tot x 1 and the optimal power on the i th channel, Pi P tot x i1 2. Proof: From (6), e Pd. Since d 1 P tot and d i 0, 2 i NK from Theorem 2.1, e d 1 x 1 P tot x 1. Since Pi Ei 2, Pi P tot x i1 2 (resulting in Pi 0, i and NK P i P tot, i.e., feasible transmit powers on all the fragments). It is noted that in general, x i1 can be non-zero, i and hence, the malicious attacker transmits non-zero powers on all the fragments to create imum leakage. In the case of aggregation or bonding with no fragmentation, a similar scenario arises, which is explained as follows. Let the system contain N channels and let channels m and n be aggregated to result in N 1 channels in the system. Let m denote the new channel obtained by aggregating channels m and n. The channel, m need not be orthogonal to the other channels in the system and this, in turn can cause leakage into other channels. Similarly transmission on other channels can cause leakage into m. The analysis described in this paper can then be used to determine the transmit power of the attacker on each channel. Let Ñ be the white noise on all the channels in the absence of the leakage due to the transmission by the malicious attacker. Let the signal power on the i th fragment be S i. The signal-to-noise-ratio (SNR) on the i th fragment, γ i, is then given by γ i Si. In the presence of leakage due to transmission by a malicious attacker, the signal-to-interference- Ñ noise-ratio (SINR) on the i th fragment, ˆγ i, can be written as ˆγ i Si, where l l 2 i +Ñ i NK j1 C ije j. Note that ˆγ i < γ i, thus resulting in a degraded signal quality. For a channel with bandwidth, B, This degradation can result in( a degradation in the channel capacity by an amount, B log 1+γi 2 1+ˆγ i ). It is noted that jamming a particular channel also causes loss of capacity. However, fragmentation causes a larger threat because a malicious attacker can transmit on channel j to cause a loss of capacity on channel i. This kind of an attack is a result of fragmentation and aggregation because of loss of orthogonality between the fragments. Hence, the service disruption caused by the malicious attacker as a consequence of fragmentation and aggregation, is a cognitive service disruption where the attacker intelligently transmits powers on the channels to disrupt service on the other channels. III. RESULTS AND DISCUSSION We consider two systems, one with N 3 orthogonal channels (like the IEEE ), each with bandwidth, 20 MHz, fragmented into K 3 fragments, each with bandwidth, 6.66 MHz, thus resulting in N K 9 fragments in the system. We also study a system with N 13 orthogonal channels each fragmented into K 3 fragments, to result in NK 39 fragments in the system. We first consider a fixed value of P tot and compute the optimal transmit powers on all the channels in the system with NK 9 fragments. We then vary the total power that can be transmitted by the malicious attacker, P tot, and study the average loss in the capacity due to leakage. The optimal transmit power of the malicious attacker hence, the leakage on each channel, is obtained using the analysis described in Section II. The covariance matrix, C is generated using the standard inner product of the carrier frequencies [15]. TABLE I TRANSMIT POWERS FOR THE MALICIOUS ATTACKER WITH P tot 10 WATTS, ON EACH FRAGMENT IN A SYSTEM WITH N 3 ORTHOGONAL CHANNELS EACH FRAGMENTED INTO K 3 FRAGMENTS. Fragment Power (P i ) mw mw mw Watts mw mw Watts Watts mw Table I presents the transmit powers on all the fragments for a malicious attacker with P tot 10 Watts in a system with N 3 orthogonal channels, each fragmented into K 3 fragments, thus resulting in NK 9 fragments. It is observed that the transmit powers on all the fragments are non-zero, as argued in Section II. It is observed from Table I, that a small transmit power on any fragment (e.g., 133 mw in fragment 3) can also result in imum leakage on that fragment when combined with a larger transmit power on another fragment (e.g., 3.4 Watts in fragment 8). This reinforces the argument presented in Section I about cognitive service disruption resulting as a consequence of fragmentation. The average loss in the capacity was found to be 20 Kbps. We vary the total transmit power, P tot, and determine the average loss in capacity. Fig. 2 presents the average loss in the capacity in a system with N 3 orthogonal channels each fragments into K 3 fragments, thus resulting in NK 9 fragments. It is observed that the loss in capacity is negligible for low values of the total transmit power, P tot, where as, for large values of P tot, the loss is significant. The loss in capacity can be as large as 200 Kbps, which, for a system supporting 1-2 Mbps, is a loss of about 16%. The average loss is larger in the system with N 13 orthogonal channels fragmented into K 3 fragments (which typically supports 54 Mbps [4]), resulting in NK 39 fragments, as observed from Fig. 3. Here, loss of the order of up to 9 Mbps is observed. In a system supporting 54 Mbps traffic, this corresponds to a loss in capacity by 11%. The larger loss in capacity is caused due to that fact that there are larger number of fragments and hence, correlations between multiple pairs of fragments. This enables the attacker to transmit in more fragments and cause service disruption. 4

5 Average loss in the channel capacity (Kbps) Total transmit power, P (W) tot Fig. 2. Average loss in the capacity of due to cognitive disruption in a system with N 3 orthogonal channels each fragmented into K 3 fragments. Average loss in the channel capacity (Mbps) Total transmit power, P tot (W) [3] C. Cordeiro, K. Challapali, D. Birru, and S. Shankar, Ieee : The first worldwide wireless standard based on cognitive radios, Proc., IEEE Symposium of New Frontiers in Dynamic Spectrum Access Networks (DySPAN) 2005, pp , Nov [4] IEEE draft standard for information technology Telecommunications and information exchange between systems Local and metropolitan area networks Part 22.1: Standard to enhance harmful interference protection for low power licensed devices operating in the TV broadcast bands, Feb [5] S. Sengupta, S. Brahma, M. Chatterjee, and N. S. Shankar, Enhancements to cognitive radio based IEEE air interface, Proc. IEEE Intl. Conf. on Commun. (ICC 2007), pp , Jun [6] H. Song and X. Lin, A novel DSA driven MAC protocol for cognitive radio networks, Wireless Sensor Networks, vol. 61, no. 2, pp , Feb [7] P. Bahl, R. Chandra, T. Moscibroda, R. Murthy, and M. Welsh, White space networking withwi-fi like connectivity, Proc., SIGCOMM 2009, Aug [8] S. Deb, V. Srinivasan, and R. Maheshwari, Dynamic spectrum access in DTV white spaces: Design rules, architecture and algorithms, Proc., ACM Intl. Conf. on Mobile Computing and Networking (ICMC( 2009), Sep [9] E. Coffman, P. Robert, F. Simatos, S. Tarumi, and G. Zussman, Channel fragmentation in dynamic spectrum access systems: A theoretical study, ACM SIGMETRICS Perf. Eval. review, vol. 38, no. 1, pp , Jun [10] J. Geier, Designing and Deploying n Wireless Networks. Cisco Press, [11] S. Sengupta, K. Hong, R. Chandramouli, and K. P. Subbalakshmi, Spiderradio: A cognitive radio network with commodity hardware and open source software, To appear in IEEE Commun. Mag., [12] T. Basar, A Gaussian test channel with an intelligent jammer, IEEE Trans. on Info. Theory, vol. 29, no. 1, pp , Jan [13] A. Sampath, H. Dai, H. Zheng, and B. Y. Zhao, Multi-channel jamming attacks using cognitive radios, Proc. IEEE Intl. Conf. on Computer Commun. and Networking (ICCCN 2007), Aug [14] S. Anand, S. Sengupta, and R. Chandramouli, An attack-defense game theoretic analysis of multi-band wireless covert timing networks, Proc. IEEE Intl. Conf. on Computer Commun. (INFOCOM 2010), Mar [15] Y. Shmaliy, Continuous-time Signals (Signals and Communication Technology. Springer, [16] C. D. Meyer, Matrix Theory and Applied Linear Algebra. SIAM, Fig. 3. Average loss in the capacity of due to cognitive disruption in a system with N 13 orthogonal channels each fragmented into K 3 fragments. IV. CONCLUSION We presented the first discussion and analysis on a unique cognitive service disruption threat in IEEE based DSA networks, arising as a consequence of channel fragmentation. We presented an experimental result to motivate the problem and presented an analysis to determine the transmit power of the malicious attacker to create imum service disruption. Numerical results indicate that small transmit powers on a fragment can cause significant loss in capacity when combined with larger transmit powers on other fragments. It was also observed that fragmentation could result in loss of capacity of up to 16%. Mitigation of such threats is under investigation and is also a topic for further research. REFERENCES [1] M. Buddhikot, P. Kolodzy, S. Miller, K. Ryan, and J. Evans, DIMSUMnet: New directions in wireless networking using coordinated dynamic spectrum access, IEEE WoWMoM 2005, Oct [2] J. Mitola, Cognitive Radio: An integrated agent architecture for software defined radio. Ph.D. Dissertation, Swedish Royal Institute of Technology,